ArmPlatformPkg, MdeModulePkg, SecurityPkg: Update Tpm2StartupLib by Raymond-MS · Pull Request #1866 · microsoft/mu_basecore

Raymond-MS · 2026-07-27T22:18:58Z

Description

Updated the Tpm2StartupLib to consolidate the functionality from Tcg2Pei. This functionality was updated such that it can be used in both SEC and PEI. Updated PeilessSec to include the updated Tpm2StartupLib functionality. Moved the SyncPcrs functionality to Tcg2Dxe; this is only able to be done when the PCD lib is available due to dynamic PCDs. This gives us a common location for syncing to occur on both PEI and PEI-less platforms. Created a fixed version of the DeviceStateLib. This was required due to the use of another dynamic PCD which is not available in SEC. Moved the PCD in MdeModulePkg.dec such that it can be set as FixedAtBuild.

For details on how to complete these options and their meaning refer to CONTRIBUTING.md.

How This Was Tested

Verified boot to UEFI shell on both Q35 (PEI path) and VIRT (SEC path).

Integration Instructions

Add Tpm2StartupLib.inf to your platform's .dsc.

This reverts commit 4de8ea1.

mu-automation · 2026-07-27T22:19:12Z

✅ QEMU Validation Passed

Source Dependencies

Repository	Commit
mu_basecore	`387deef`
mu_tiano_platforms	`d8ecfb8`

Results

Platform	Target	Build	Boot	Overall Boot Time	Build Logs	Boot Logs
Q35	DEBUG	✅ success	✅ success	0m 19s	Build Logs	Boot Logs
ArmVirt	DEBUG	✅ success	✅ success	0m 15s	Build Logs	Boot Logs

Workflow run: https://github.com/microsoft/mu_basecore/actions/runs/30313400091

This comment was automatically generated by the Mu QEMU PR Validation workflow.

…Pei. This functionality was updated such that it can be used in both SEC and PEI. Updated PeilessSec to include the updated Tpm2StartupLib functionality. Verified boot to UEFI shell on both Q35 (PEI path) and VIRT (SEC path). Moved the SyncPcrs functionality to Tcg2Dxe; this is only able to be done when the PCD lib is available due to dynamic PCDs. This gives us a common location for syncing to occur on both PEI and PEI-less platforms. Created a fixed version of the DeviceStateLib. This was required due to the use of another dynamic PCD which is not available in SEC. Moved the PCD in MdeModulePkg.dec such that it can be set as FixedAtBuild.

Copilot

Pull request overview

This PR refactors TPM2 startup and early measurement flows by consolidating logic into Tpm2StartupLib so it can be invoked from both PEI (traditional) and SEC (PEI-less) paths. It also relocates PCR bank sync logic into DXE (where dynamic PCD writes are legal) and introduces a phase-agnostic mechanism (HOB) for passing pre-hashed FV digests.

Changes:

Consolidate TPM startup + pre-DXE measurements into SecurityPkg/Library/Tpm2StartupLib, and update PEI/SEC call sites to use the new entry points.
Add a new gPrehashedFvHobGuid and HOB format for pre-hashed FV digests; update Tcg2 PEI to translate the pre-hashed FV PPI into these HOBs.
Move PCR bank sync logic to Tcg2Dxe and adjust PCD consumption accordingly.

Reviewed changes

Copilot reviewed 19 out of 19 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf	Removes direct deps and switches PEI flow to use `Tpm2StartupLib`; adds PrehashedFV PPI + HOB GUID usage.
SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c	Replaces in-module TPM init/measurement logic with `Tpm2StartupLib` calls; adds translation of excluded/prehashed FV PPIs to HOBs.
SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf	Adds PCDs and libs needed for PCR allocation/mask sync in DXE.
SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c	Implements DXE-side PCR bank/mask synchronization and calls it from driver entry.
SecurityPkg/SecurityPkg.dec	Adds `gPrehashedFvHobGuid` and documents its intent.
SecurityPkg/Library/Tpm2StartupLibNull/Tpm2StartupLibNull.inf	Drops unused `DebugLib` dependency.
SecurityPkg/Library/Tpm2StartupLibNull/Tpm2StartupLibNull.c	Expands NULL lib to provide no-op implementations for the new `Tpm2StartupLib` API.
SecurityPkg/Library/Tpm2StartupLib/Tpm2StartupLib.inf	Updates library dependencies and declares additional PCD/GUID usage needed after consolidation.
SecurityPkg/Library/Tpm2StartupLib/Tpm2StartupLib.c	Implements consolidated TPM startup, core measurements, FV measurement, and measured-FV HOB publishing.
SecurityPkg/Library/HashLibTpm2/HashLibTpm2PeilessSecLib.inf	Removes unused PEI-less SEC dependencies tied to transfer list parsing.
SecurityPkg/Library/HashLibTpm2/HashLibTpm2PeilessSecLib.c	Changes hash bitmap selection to derive from TPM active PCR banks instead of transfer list event log parsing.
SecurityPkg/Include/Library/Tpm2StartupLib.h	Defines the expanded `Tpm2StartupLib` API used by both PEI and PEI-less SEC paths.
SecurityPkg/Include/Guid/PrehashedFvHob.h	Introduces the phase-agnostic HOB payload definition for pre-hashed FV digests.
MdeModulePkg/MdeModulePkg.dec	Moves `PcdDeviceStateBitmask` so it can be set `FixedAtBuild`.
MdeModulePkg/Library/DeviceStateLib/DeviceStateLibFixed.inf	Adds a FixedAtBuild-compatible `DeviceStateLib` implementation for SEC environments.
MdeModulePkg/Library/DeviceStateLib/DeviceStateLibFixed.c	Implements read-only device-state access and returns `RETURN_UNSUPPORTED` for writes.
ArmPlatformPkg/PeilessSec/PeilessSec.h	Adds `Tpm2StartupLib` include for PEI-less SEC.
ArmPlatformPkg/PeilessSec/PeilessSec.c	Replaces legacy startup call with new consolidated TPM init/measurement/FV measurement flow.
ArmPlatformPkg/ArmPlatformPkg.dsc	Removes the explicit binding to the NULL `Tpm2StartupLib` instance for PEI-less SEC.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+    if ((Hdr->FvBase == FvBase) && (Hdr->FvLength == FvLength)) {
+      PreHashInfo = (HASH_INFO *)(Hdr + 1);
+      DigestCount = 0;
+      for (Index = 0; Index < Hdr->Count; Index++) {
+        HashAlgoMask = GetHashMaskFromAlgo (PreHashInfo->HashAlgoId);
+        if ((*RemainingTpm2HashMask & HashAlgoMask) != 0) {
+          WriteUnaligned16 (&(DigestList->digests[DigestCount].hashAlg), PreHashInfo->HashAlgoId);
+          CopyMem (&DigestList->digests[DigestCount].digest, PreHashInfo + 1, PreHashInfo->HashSize);
+          DigestCount++;
+          *RemainingTpm2HashMask &= ~HashAlgoMask;
+        }
+
+        PreHashInfo = (HASH_INFO *)((UINT8 *)(PreHashInfo + 1) + PreHashInfo->HashSize);
+      }
+
+      WriteUnaligned32 (&DigestList->count, DigestCount);
+      return EFI_SUCCESS;
+    }


+    Status = Tpm2PcrAllocateBanks (NULL, (UINT32)TpmHashAlgorithmBitmap, Tpm2PcrMask);
+    if (EFI_ERROR (Status)) {
+      DEBUG ((DEBUG_ERROR, "%a - Failed to reallocate PCRs!\n", __func__));
+      ASSERT_EFI_ERROR (Status);
+    }
+
+    ResetCold ();
+  }


+      if (MeasurementExcludedFvPpi->Count <= 0) {
+        DEBUG ((DEBUG_ERROR, "ExcludedFvPpi has invalid count %d", MeasurementExcludedFvPpi->Count));
+        ASSERT (MeasurementExcludedFvPpi->Count > 0);


codecov-commenter · 2026-07-27T22:42:48Z

Codecov Report

❌ Patch coverage is 0% with 16 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (release/202511@edf0cd0). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
...lePkg/Library/DeviceStateLib/DeviceStateLibFixed.c	0.00%	16 Missing ⚠️

Additional details and impacted files

@@                Coverage Diff                @@
##             release/202511    #1866   +/-   ##
=================================================
  Coverage                  ?    1.91%           
=================================================
  Files                     ?     1025           
  Lines                     ?   336602           
  Branches                  ?     2634           
=================================================
  Hits                      ?     6449           
  Misses                    ?   330112           
  Partials                  ?       41

Flag	Coverage Δ
FmpDevicePkg	`9.53% <ø> (?)`
MdeModulePkg	`1.67% <0.00%> (?)`
NetworkPkg	`0.55% <ø> (?)`
PolicyServicePkg	`30.42% <ø> (?)`
StandaloneMmPkg	`0.48% <ø> (?)`
UefiCpuPkg	`4.78% <ø> (?)`
UnitTestFrameworkPkg	`11.70% <ø> (?)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Revert "ArmPkg/PeilessSec: Consume Tpm2StartupLib (microsoft#1692)"

b3a996a

This reverts commit 4de8ea1.

Raymond-MS requested review from cfernald, Copilot, kuqin12 and spbrogan July 27, 2026 22:19

Copilot started reviewing on behalf of Raymond-MS July 27, 2026 22:20 View session

Raymond-MS force-pushed the personal/rdiaz/Tpm2StartupLibUpdates branch from e1fc822 to 76b0397 Compare July 27, 2026 22:25

Copilot AI reviewed Jul 27, 2026

View reviewed changes

Added a default value for PcdDeviceStateBitmask

63410bd

Updated line endings.

387deef

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

ArmPlatformPkg, MdeModulePkg, SecurityPkg: Update Tpm2StartupLib - #1866

ArmPlatformPkg, MdeModulePkg, SecurityPkg: Update Tpm2StartupLib#1866
Raymond-MS wants to merge 4 commits into
microsoft:release/202511from
Raymond-MS:personal/rdiaz/Tpm2StartupLibUpdates

Raymond-MS commented Jul 27, 2026

Uh oh!

mu-automation Bot commented Jul 27, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

codecov-commenter commented Jul 27, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Raymond-MS commented Jul 27, 2026

Description

How This Was Tested

Integration Instructions

Uh oh!

mu-automation Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ QEMU Validation Passed

Source Dependencies

Results

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

codecov-commenter commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

mu-automation Bot commented Jul 27, 2026 •

edited

Loading

codecov-commenter commented Jul 27, 2026 •

edited

Loading